CVE-2026-77371 in Redash
Summary
by MITRE • 10/15/2026
Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within Redash versions ranging from 26.0.0 to 26.9.0 stems from a misconfiguration in the DuckDB query runner, specifically located in the _connect() method of the redash/query_runner/duckdb.py module. This component is responsible for establishing database connections when users execute queries against data sources configured with DuckDB as the backend engine. The core technical flaw lies in the fact that the enable_external_access parameter was left at its default value of true during connection initialization. In the context of DuckDB, this setting permits the execution of native file-reading and writing functions directly within SQL statements, effectively bypassing standard database sandboxing restrictions that would otherwise limit access to internal data structures only.
From a technical perspective, an attacker possessing query access privileges against any administrator-created DuckDB data source can exploit this configuration by leveraging built-in filesystem operations such as read_file or COPY TO commands. These functions allow the execution environment to interact with the underlying operating system's file hierarchy using the permissions of the Redash application process. Consequently, a malicious user could construct specific SQL queries designed to read arbitrary files from the server where Redash is hosted. This capability transforms what appears to be a standard data visualization tool into a vector for local file inclusion and potential remote code execution scenarios depending on subsequent exploitation steps.
The operational impact of this vulnerability is severe due to its direct implication on authentication integrity and system confidentiality. By reading sensitive configuration files, an attacker can extract critical application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY. Possession of these cryptographic keys allows the adversary to forge valid session cookies for any user account within the Redash instance, including those with administrative privileges. This results in a complete authentication bypass, enabling unauthorized access to all data sources and visualizations managed by the platform without requiring valid credentials. Furthermore, the ability to write files using COPY TO could potentially be used to plant malicious scripts or modify configuration files if file path constraints are not strictly enforced elsewhere in the application logic.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves an actor gaining unauthorized access to resources due to insufficient restrictions on external interactions. Additionally, from a threat modeling perspective consistent with MITRE ATT&CK frameworks, this behavior maps to T1005 Data from Local System and potentially T1539 Steal Web Session Cookie, highlighting the risk of credential theft through local file system exploitation. The lack of input validation or configuration hardening in the query runner allows low-privileged users to escalate their impact significantly by interacting with the host operating system directly via database commands.
To mitigate this vulnerability and prevent similar issues in future deployments, it is imperative that organizations running Redash upgrade immediately to version 26.9.0 or later, where the default value for enable_external_access has been corrected to false. For environments that cannot yet upgrade, administrators should manually review their DuckDB data source configurations to ensure that external access is explicitly disabled if not strictly required for legitimate business operations. Security teams should also audit existing logs for any suspicious SQL queries containing file system functions such as read_file or COPY TO, which may indicate active exploitation attempts against unpatched instances. Regular security assessments of database connectors are recommended to verify that sandboxing mechanisms remain intact and do not inadvertently expose the host environment to user-supplied input.